# DPDP personal data breach notification workbook

Incident ID: [ID]
Opened: [DATE AND TIME, TIMEZONE]
Incident commander: [NAME / ROLE]

> Educational starting point, not legal advice. Use current official sources and your incident counsel. Do not delay containment or a notification required without delay while waiting for every field to become certain. Record unknowns, assumptions and planned updates.

## 1. Trigger assessment and first facts

- Detection time and source: [VALUE]
- Earliest known incident time: [VALUE / UNKNOWN]
- Systems and processors involved: [VALUE]
- Personal data involved: [VALUE]
- Approximate Data Principals affected: [VALUE / RANGE / UNKNOWN]
- Confidentiality, integrity or availability compromised: [VALUE]
- Current containment state: [VALUE]
- Evidence preservation owner and location: [VALUE]

## 2. Decision log

| Time | Fact or decision | Source | Confidence | Owner | Next update |
|---|---|---|---|---|---|
| [TIME] | [FACT / DECISION] | [SOURCE] | [CONFIRMED / LIKELY / UNKNOWN] | [OWNER] | [TIME] |

Record who classified the event as a personal data breach, when notification decisions were made, what was unknown and why any extension was requested.

## 3. Notice to affected Data Principals — without delay

Draft concise, clear and plain-language content covering:

1. Nature of the breach: [WHAT HAPPENED]
2. Extent of the breach: [DATA / PEOPLE / PERIOD]
3. Timing: [WHEN IT OCCURRED OR WAS DETECTED]
4. Location: [SYSTEM / SERVICE / RELEVANT CONTEXT]
5. Likely consequences: [PRACTICAL EFFECTS]
6. Measures implemented to mitigate risk: [ACTIONS TAKEN]
7. Safety measures the individual may take: [SPECIFIC STEPS]
8. Contact information: [RESPONSIBLE CONTACT]

Delivery channels, accessibility and language versions: [VALUE]

Approval and dispatch evidence: [VALUE]

## 4. Initial intimation to the Data Protection Board — without delay

- Nature and extent of the breach: [VALUE]
- Location and timing: [VALUE]
- Likely impact: [VALUE]
- Mitigation implemented: [VALUE]
- Known facts still being investigated: [VALUE]
- Responsible contact and next update: [VALUE]

Submission time, channel and receipt: [VALUE]

## 5. Fuller Board submission — within 72 hours unless extended

- Updated and detailed facts: [VALUE]
- Broad events, circumstances and reasons leading to the breach: [VALUE]
- Measures implemented or proposed to mitigate risk: [VALUE]
- Findings about the person who caused the breach, if known: [VALUE]
- Remedial measures taken to prevent recurrence: [VALUE]
- Report of communications made to affected Data Principals: [VALUE]
- Any request for additional time and the reasons: [VALUE]

Submission deadline: [DATE AND TIME, TIMEZONE]

Submission time, channel and receipt: [VALUE]

## 6. Processor coordination

| Processor | Notice received | Evidence preserved | Facts due | Contract owner | Escalation status |
|---|---|---|---|---|---|
| [NAME] | [TIME] | [YES / NO] | [TIME] | [OWNER] | [STATUS] |

## 7. Closure and improvement

- Root cause approved: [VALUE]
- Corrective actions and owners: [VALUE]
- Control tests completed: [VALUE]
- Retention or legal-hold decision: [VALUE]
- Board or Data Principal follow-up: [VALUE]
- Tabletop/runbook changes approved: [VALUE]